2013 CVEs (page 4)
Page 4 of 69 — CVEs published in 2013, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2013-1593 | High | 7.5 | 2020-01-23 | A Denial of Service vulnerability exists in the WRITE_C function in the msg_server.exe module in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04 when s… |
CVE-2013-1592 | Critical | 9.8 | 2020-01-23 | A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets… |
CVE-2013-6792 | Critical | 9.8 | 2020-01-23 | Google Android prior to 4.4 has an APK Signature Security Bypass Vulnerability |
CVE-2013-6785 | Medium | 4.3 | 2020-01-23 | Directory traversal vulnerability in url_redirect.cgi in Supermicro IPMI before SMT_X9_315 allows authenticated attackers to read arbitrary files via the url_n… |
CVE-2013-6773 | High | 7.8 | 2020-01-23 | Splunk 5.0.3 has an Unquoted Service Path in Windows for Universal Forwarder which can allow an attacker to escalate privileges |
CVE-2013-6772 | Medium | 4.3 | 2020-01-23 | Splunk before 5.0.4 lacks X-Frame-Options which can allow Clickjacking |
CVE-2013-6358 | High | 8.8 | 2020-01-23 | PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory. |
CVE-2013-4176 | Medium | 5.5 | 2020-01-23 | mysecureshell 1.31: Local Information Disclosure Vulnerability |
CVE-2013-4175 | Medium | 5.5 | 2020-01-23 | MySecureShell 1.31 has a Local Denial of Service Vulnerability |
CVE-2013-7185 | High | 7.8 | 2020-01-14 | PotPlayer 1.5.40688: .avi File Memory Corruption |
CVE-2013-2773 | High | 7.8 | 2020-01-14 | Nitro PDF 8.5.0.26: A specially crafted DLL file can facilitate Arbitrary Code Execution |
CVE-2013-6225 | Critical | 9.8 | 2020-01-13 | LiveZilla 5.0.1.4 has a Remote Code Execution vulnerability |
CVE-2013-7380 | Critical | 9.8 | 2020-01-10 | The Etherpad Lite ep_imageconvert Plugin has a Remote Command Injection Vulnerability |
CVE-2013-6430 | Medium | 5.4 | 2020-01-10 | The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain ch… |
CVE-2013-6231 | High | 8.8 | 2020-01-10 | SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script |
CVE-2013-5658 | Medium | 6.1 | 2020-01-07 | AultWare pwStore 2010.8.30.0 has XSS |
CVE-2013-5657 | High | 7.5 | 2020-01-07 | AultWare pwStore 2010.8.30.0 has DoS via an empty HTTP request |
CVE-2013-5656 | High | 7.8 | 2020-01-07 | FuzeZip 1.0.0.131625 has a Local Buffer Overflow vulnerability |
CVE-2013-5638 | Medium | 5.4 | 2020-01-07 | Transcend WiFiSD 1.8 has persistent XSS |
CVE-2013-5637 | Medium | 5.4 | 2020-01-07 | PQI AirCard has persistent XSS |
CVE-2013-5571 | Medium | 5.9 | 2020-01-07 | HMailServer 5.3.x and prior: Memory Corruption which could cause DOS |
CVE-2013-5122 | Critical | 9.8 | 2020-01-07 | Cisco Linksys Routers EA2700, EA3500, E4200, EA4500: A bug can cause an unsafe TCP port to open which leads to unauthenticated access |
CVE-2013-1642 | Medium | 6.1 | 2020-01-02 | Multiple cross-site scripting (XSS) vulnerabilities in QuiXplorer before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) dir, (… |
CVE-2013-1420 | Medium | 6.1 | 2020-01-02 | Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id… |
CVE-2013-0737 | Medium | 6.1 | 2020-01-02 | Cross-site scripting (XSS) vulnerability in BoltWire 3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the fieldnames paramete… |
CVE-2013-7351 | Medium | 6.1 | 2020-01-02 | Multiple cross-site scripting (XSS) vulnerabilities in index.php in Shaarli allow remote attackers to inject arbitrary web script or HTML via the URL to the (1… |
CVE-2013-3941 | Critical | 9.8 | 2020-01-02 | Xjp2.dll in XnView before 2.13 allows remote attackers to execute arbitrary code via (1) the Csiz parameter in a SIZ marker, which triggers an incorrect memory… |
CVE-2013-3939 | High | 7.8 | 2020-01-02 | xnview.exe in XnView before 2.13 does not properly handle RLE strip lengths during processing of RGB files, which allows remote attackers to execute arbitrary… |
CVE-2013-3937 | High | 7.8 | 2020-01-02 | Heap-based buffer overflow in xnview.exe in XnView before 2.13 allows remote attackers to execute arbitrary code via the biBitCount field in a BMP file. |
CVE-2013-3932 | High | 8.8 | 2020-01-02 | SQL injection vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "Business Manager" permiss… |
CVE-2013-3931 | Medium | 5.4 | 2020-01-02 | Cross-site scripting (XSS) vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "Business Man… |
CVE-2013-3247 | High | 7.8 | 2020-01-02 | Heap-based buffer overflow in xnview.exe in XnView before 2.03 allows remote attackers to execute arbitrary code via a crafted RLE compressed layer in an XCF f… |
CVE-2013-3246 | High | 7.8 | 2020-01-02 | Stack-based buffer overflow in xnview.exe in XnView before 2.03 allows remote attackers to execute arbitrary code via a crafted image layer in an XCF file. |
CVE-2013-7486 | Medium | 6.1 | 2020-01-02 | Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev27 and 7.4.x before 7.4.0-rev20 allows remote attac… |
CVE-2013-7485 | Medium | 6.1 | 2020-01-02 | Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev26 and 7.4.x before 7.4.0-rev16 allows remote attac… |
CVE-2013-7062 | Medium | 6.1 | 2020-01-02 | Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2… |
CVE-2013-6242 | Medium | 6.1 | 2020-01-02 | Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-rev12 allows remote a… |
CVE-2013-3946 | High | 7.8 | 2020-01-02 | Heap-based buffer overflow in the MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via a levels header. |
CVE-2013-3945 | High | 7.8 | 2020-01-02 | The MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via a nband tag. |
CVE-2013-3944 | High | 7.8 | 2020-01-02 | Stack-based buffer overflow in the MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via an IMAGE tag. |
CVE-2013-3620 | High | 7.5 | 2020-01-02 | Hardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before 3.15 (SMT_X9_315… |
CVE-2013-3619 | High | 8.1 | 2020-01-02 | Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 gener… |
CVE-2013-4752 | Medium | 6.1 | 2020-01-02 | Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can… |
CVE-2013-4532 | High | 7.8 | 2020-01-02 | Qemu 1.1.2+dfsg to 2.1+dfsg suffers from a buffer overrun which could potentially result in arbitrary code execution on the host with the privileges of the QEM… |
CVE-2013-3936 | Medium | 6.1 | 2020-01-02 | Multiple cross-site scripting (XSS) vulnerabilities in Opsview before 4.4.1 and Opsview Core before 20130522 allow remote attackers to inject arbitrary web scr… |
CVE-2013-3935 | High | 8.8 | 2020-01-02 | Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.1 and Opsview Core before 20130522 allows remote attackers to hijack the authentication o… |
CVE-2013-7071 | Medium | 6.1 | 2019-12-31 | Cross-site scripting (XSS) vulnerability in the handle_request function in lib/HTTPServer.pm in Monitorix before 3.4.0 allows remote attackers to inject arbitr… |
CVE-2013-7070 | Critical | 9.8 | 2019-12-31 | The handle_request function in lib/HTTPServer.pm in Monitorix before 3.3.1 allows remote attackers to execute arbitrary commands via shell metacharacters in th… |
CVE-2013-4357 | High | 7.5 | 2019-12-31 | The eglibc package before 2.14 incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service. |
CVE-2013-4161 | High | 7.8 | 2019-12-31 | gksu-polkit-0.0.3-6.fc18 was reported as fixing the issue in CVE-2012-5617 but the patch was improperly applied and it did not fixed the security issue. |
CVE-2013-2016 | High | 7.8 | 2019-12-30 | A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio devic… |
CVE-2013-0264 | High | 7.5 | 2019-12-30 | An import error was introduced in Cumin in the code refactoring in r5310. Server certificate validation is always disabled when connecting to Aviary servers, e… |
CVE-2013-0196 | Medium | 6.5 | 2019-12-30 | A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. T… |
CVE-2013-5027 | Critical | 9.8 | 2019-12-27 | Collabtive 1.0 has incorrect access control |
CVE-2013-4985 | High | 7.5 | 2019-12-27 | Multiple Vivotek IP Cameras remote authentication bypass that could allow access to the video stream |
CVE-2013-4982 | Critical | 9.8 | 2019-12-27 | AVTECH AVN801 DVR has a security bypass via the administration login captcha |
CVE-2013-4976 | Critical | 9.8 | 2019-12-27 | Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials |
CVE-2013-4975 | High | 8.8 | 2019-12-27 | Hikvision DS-2CD7153-E IP Camera has Privilege Escalation |
CVE-2013-4868 | Medium | 5.3 | 2019-12-27 | Karotz API 12.07.19.00: Session Token Information Disclosure |
CVE-2013-4867 | Medium | 6.3 | 2019-12-27 | Electronic Arts Karotz Smart Rabbit 12.07.19.00 allows Python module hijacking |
CVE-2013-4859 | High | 8.1 | 2019-12-27 | INSTEON Hub 2242-222 lacks Web and API authentication |
CVE-2013-4796 | High | 8.8 | 2019-12-27 | ReviewBoard 1.6.17 allows code execution by attaching PHP scripts to review request |
CVE-2013-4764 | Medium | 4.3 | 2019-12-27 | Samsung Galaxy S3/S4 exposes an unprotected component allowing an unprivileged app to send arbitrary SMS texts to arbitrary destinations without permission. |
CVE-2013-4763 | Medium | 4.6 | 2019-12-27 | Samsung Galaxy S3/S4 exposes an unprotected component allowing arbitrary SMS text messages without requesting permission. |
CVE-2013-4743 | Critical | 9.8 | 2019-12-27 | Static HTTP Server 1.0 has a Local Overflow |
CVE-2013-4692 | Medium | 6.1 | 2019-12-27 | Xorbin Analog Flash Clock 1.0 extension for Joomia has XSS |
CVE-2013-4621 | Critical | 9.8 | 2019-12-27 | Magnolia CMS before 4.5.9 has multiple access bypass vulnerabilities |
CVE-2013-4695 | High | 7.8 | 2019-12-27 | Winamp 5.63: Invalid Pointer Dereference leading to Arbitrary Code Execution |
CVE-2013-4693 | Medium | 6.1 | 2019-12-27 | WordPress Xorbin Digital Flash Clock 1.0 has XSS |
CVE-2013-4691 | Medium | 6.1 | 2019-12-27 | Sencha Labs Connect has XSS with connect.methodOverride() |
CVE-2013-4665 | Medium | 6.5 | 2019-12-27 | SPBAS Business Automation Software 2012 has CSRF. |
CVE-2013-4664 | Medium | 6.1 | 2019-12-27 | SPBAS Business Automation Software 2012 has XSS. |
CVE-2013-3088 | Critical | 9.8 | 2019-12-26 | Belkin N900 router (F9K1104v1) contains an Authentication Bypass using "Javascript debugging". |
CVE-2013-3085 | Critical | 9.8 | 2019-12-26 | An authentication bypass exists in the web management interface in Belkin F5D8236-4 v2. |
CVE-2013-4318 | Medium | 5.4 | 2019-12-26 | File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory. |
CVE-2013-2011 | High | 8.8 | 2019-12-26 | WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issu… |
CVE-2013-0202 | Medium | 6.1 | 2019-12-17 | Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbitrary web script or HTML via the action p… |
CVE-2013-5978 | Medium | 6.1 | 2019-12-11 | Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject ar… |
CVE-2013-5743 | Critical | 9.8 | 2019-12-11 | Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7. |
CVE-2013-4303 | Medium | 6.1 | 2019-12-11 | includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detec… |
CVE-2013-3691 | High | 7.5 | 2019-12-11 | AirLive POE-2600HD allows remote attackers to cause a denial of service (device reset) via a long URL. |
CVE-2013-3542 | Critical | 10.0 | 2019-12-11 | Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models w… |
CVE-2013-4968 | Medium | 6.1 | 2019-12-11 | Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors related to the console, and (2) conduct cros… |
CVE-2013-7371 | Medium | 6.1 | 2019-12-11 | node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370) |
CVE-2013-7370 | Medium | 6.1 | 2019-12-11 | node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware |
CVE-2013-6495 | Medium | 6.1 | 2019-12-11 | JBossWeb Bayeux has reflected XSS |
CVE-2013-4593 | High | 7.5 | 2019-12-11 | RubyGem omniauth-facebook has an access token security vulnerability |
CVE-2013-4245 | High | 7.3 | 2019-12-11 | Orca has arbitrary code execution due to insecure Python module load |
CVE-2013-4158 | Medium | 6.1 | 2019-12-11 | smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790) |
CVE-2013-1689 | Medium | 6.5 | 2019-12-10 | Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), related to event handling with frames. |
CVE-2013-4184 | Medium | 5.5 | 2019-12-10 | Perl module Data::UUID from CPAN version 1.219 vulnerable to symlink attacks |
CVE-2013-4133 | High | 7.5 | 2019-12-10 | kde-workspace before 4.10.5 has a memory leak in plasma desktop |
CVE-2013-4120 | High | 7.5 | 2019-12-10 | Katello has a Denial of Service vulnerability in API OAuth authentication |
CVE-2013-2183 | High | 7.1 | 2019-12-10 | Monkey HTTP Daemon has local security bypass |
CVE-2013-2167 | Critical | 9.8 | 2019-12-10 | python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass |
CVE-2013-2166 | Critical | 9.8 | 2019-12-10 | python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass |
CVE-2013-2159 | Critical | 9.8 | 2019-12-10 | Monkey HTTP Daemon: broken user name authentication |
CVE-2013-2095 | Critical | 9.8 | 2019-12-10 | rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injection |
CVE-2013-1793 | High | 7.5 | 2019-12-10 | openstack-utils openstack-db has insecure password creation |
CVE-2013-0293 | High | 7.8 | 2019-12-10 | oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation |